zama-auction[.]net

Analysis of the domain zama-auction.net, created on 21 February 2026, shows a high‑risk, active phishing infrastructure. The site returns HTTP 403 responses and presents the page title “Just a moment…”, a pattern commonly used by Cloudflare challenge pages. The domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., and is hosted in the United States. SSL is provided by Google Trust Services under the WE1 certificate, indicating a valid TLS handshake but offering no assurance of legitimacy.

Technical fingerprints reveal the presence of Cloudflare Browser Insights, Cloudflare services, and HTTP/3, all typical of legitimate CDN use but also frequently leveraged to hide malicious payloads. Reputation data is strongly negative: Gridinsoft assigns a trust score of 0 / 100, and three of ninety‑three VirusTotal scanners have flagged the domain, confirming that at least a subset of security vendors consider it malicious. The domain appears on three external blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that it is being used for phishing. The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com, a service often associated with disposable or low‑cost registrations.

While the exact phishing campaign details (targeted brands, credential‑stealing pages, or malicious downloads) remain unverified, the combination of a recent registration, low trust score, multiple vendor detections, and active blocklist listings provides sufficient evidence for defensive action. Security teams should immediately add zama-auction.net to network and endpoint blocklists, enforce DNS filtering, and monitor for any outbound connections to the associated IP address. Continuous re‑scanning of the domain and its hosting infrastructure is advised, as threat actors may modify the payload or redirect traffic.